[v2] hfs/hfsplus: serialize B-tree close against folio release

[PATCH v2] hfs/hfsplus: serialize B-tree close against folio release

Posted by Bruno Produit 3 days, 3 hours ago

B-tree nodes with a zero reference count remain in the node hash until
folio reclaim or tree teardown frees them.  The folio release callbacks
remove nodes while holding hash_lock, but hfs_btree_close() walks and
frees the same hash without that lock.  Reclaim can therefore unhash and
free a node after close has loaded its pointer, causing a use-after-free
or double-free. 

The following syzkaller crashes seem to be the same UAF in 
{hfs,hfsplus}_btree_close() (or {hfs,hfsplus}_bnode_unhash()) and follow 
the same pattern, but do not contain a reproducer to confirm. 

Detach each node with hfs_bnode_unhash() while holding hash_lock before
inspecting and freeing it.  Drop the lock before hfs_bnode_free() so a
large tree is not freed while holding a spinlock.  Apply the same fix to
the matching HFS+ implementation.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d
Assisted-by: Codex:gpt-5.6-sol
Reported-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
---
 fs/hfs/btree.c     | 7 +++++--
 fs/hfsplus/btree.c | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 41b4e8fc9..4f0ddc76e 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -310,14 +310,17 @@ void hfs_btree_close(struct hfs_btree *tree)
 		return;
 
 	for (i = 0; i < NODE_HASH_SIZE; i++) {
+		spin_lock(&tree->hash_lock);
 		while ((node = tree->node_hash[i])) {
-			tree->node_hash[i] = node->next_hash;
+			hfs_bnode_unhash(node);
+			spin_unlock(&tree->hash_lock);
 			if (atomic_read(&node->refcnt))
 				pr_err("node %d:%d still has %d user(s)!\n",
 				       node->tree->cnid, node->this,
 				       atomic_read(&node->refcnt));
 			hfs_bnode_free(node);
-			tree->node_hash_cnt--;
+			spin_lock(&tree->hash_lock);
 		}
+		spin_unlock(&tree->hash_lock);
 	}
 	iput(tree->inode);
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 2ea8cd565..bd4dbdbc8 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -417,15 +417,18 @@ void hfs_btree_close(struct hfs_btree *tree)
 		return;
 
 	for (i = 0; i < NODE_HASH_SIZE; i++) {
+		spin_lock(&tree->hash_lock);
 		while ((node = tree->node_hash[i])) {
-			tree->node_hash[i] = node->next_hash;
+			hfs_bnode_unhash(node);
+			spin_unlock(&tree->hash_lock);
 			if (atomic_read(&node->refcnt))
 				pr_crit("node %d:%d "
 						"still has %d user(s)!\n",
 					node->tree->cnid, node->this,
 					atomic_read(&node->refcnt));
 			hfs_bnode_free(node);
-			tree->node_hash_cnt--;
+			spin_lock(&tree->hash_lock);
 		}
+		spin_unlock(&tree->hash_lock);
 	}
 	iput(tree->inode);

Re: [PATCH v2] hfs/hfsplus: serialize B-tree close against folio release

Posted by Viacheslav Dubeyko 2 days, 22 hours ago

On Mon, 2026-09-21 at 17:37 +0200, Bruno Produit wrote:
> B-tree nodes with a zero reference count remain in the node hash
> until
> folio reclaim or tree teardown frees them.  The folio release
> callbacks
> remove nodes while holding hash_lock, but hfs_btree_close() walks and
> frees the same hash without that lock.  Reclaim can therefore unhash
> and
> free a node after close has loaded its pointer, causing a use-after-
> free
> or double-free. 
> 
> The following syzkaller crashes seem to be the same UAF in 
> {hfs,hfsplus}_btree_close() (or {hfs,hfsplus}_bnode_unhash()) and
> follow 
> the same pattern, but do not contain a reproducer to confirm. 
> 
> Detach each node with hfs_bnode_unhash() while holding hash_lock
> before
> inspecting and freeing it.  Drop the lock before hfs_bnode_free() so
> a
> large tree is not freed while holding a spinlock.  Apply the same fix
> to
> the matching HFS+ implementation.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
> Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
> Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
> Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
> Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d

I still don't see Cc: stable@vger.kernel.org here.

> Assisted-by: Codex:gpt-5.6-sol
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
> ---
>  fs/hfs/btree.c     | 7 +++++--
>  fs/hfsplus/btree.c | 7 +++++--
>  2 files changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
> index 41b4e8fc9..4f0ddc76e 100644
> --- a/fs/hfs/btree.c
> +++ b/fs/hfs/btree.c
> @@ -310,14 +310,17 @@ void hfs_btree_close(struct hfs_btree *tree)
>  		return;
>  
>  	for (i = 0; i < NODE_HASH_SIZE; i++) {
> +		spin_lock(&tree->hash_lock);
>  		while ((node = tree->node_hash[i])) {
> -			tree->node_hash[i] = node->next_hash;
> +			hfs_bnode_unhash(node);
> +			spin_unlock(&tree->hash_lock);
>  			if (atomic_read(&node->refcnt))
>  				pr_err("node %d:%d still has %d
> user(s)!\n",
>  				       node->tree->cnid, node->this,
>  				       atomic_read(&node->refcnt));
>  			hfs_bnode_free(node);
> -			tree->node_hash_cnt--;
> +			spin_lock(&tree->hash_lock);
>  		}
> +		spin_unlock(&tree->hash_lock);
>  	}
>  	iput(tree->inode);
> diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
> index 2ea8cd565..bd4dbdbc8 100644
> --- a/fs/hfsplus/btree.c
> +++ b/fs/hfsplus/btree.c
> @@ -417,15 +417,18 @@ void hfs_btree_close(struct hfs_btree *tree)
>  		return;
>  
>  	for (i = 0; i < NODE_HASH_SIZE; i++) {
> +		spin_lock(&tree->hash_lock);
>  		while ((node = tree->node_hash[i])) {
> -			tree->node_hash[i] = node->next_hash;
> +			hfs_bnode_unhash(node);
> +			spin_unlock(&tree->hash_lock);
>  			if (atomic_read(&node->refcnt))
>  				pr_crit("node %d:%d "
>  						"still has %d
> user(s)!\n",
>  					node->tree->cnid, node-
> >this,
>  					atomic_read(&node->refcnt));
>  			hfs_bnode_free(node);
> -			tree->node_hash_cnt--;
> +			spin_lock(&tree->hash_lock);
>  		}
> +		spin_unlock(&tree->hash_lock);
>  	}
>  	iput(tree->inode);

I haven't any comments for the fix. But let me run xfstests for the
patch (at minimum for HFS+).

Thanks,
Slava.

Re: [PATCH v2] hfs/hfsplus: serialize B-tree close against folio release

Posted by Viacheslav Dubeyko 1 day, 20 hours ago

On Mon, 2026-09-21 at 12:51 -0700, Viacheslav Dubeyko wrote:
> On Mon, 2026-09-21 at 17:37 +0200, Bruno Produit wrote:
> > B-tree nodes with a zero reference count remain in the node hash
> > until
> > folio reclaim or tree teardown frees them.  The folio release
> > callbacks
> > remove nodes while holding hash_lock, but hfs_btree_close() walks
> > and
> > frees the same hash without that lock.  Reclaim can therefore
> > unhash
> > and
> > free a node after close has loaded its pointer, causing a use-
> > after-
> > free
> > or double-free. 
> > 
> > The following syzkaller crashes seem to be the same UAF in 
> > {hfs,hfsplus}_btree_close() (or {hfs,hfsplus}_bnode_unhash()) and
> > follow 
> > the same pattern, but do not contain a reproducer to confirm. 
> > 
> > Detach each node with hfs_bnode_unhash() while holding hash_lock
> > before
> > inspecting and freeing it.  Drop the lock before hfs_bnode_free()
> > so
> > a
> > large tree is not freed while holding a spinlock.  Apply the same
> > fix
> > to
> > the matching HFS+ implementation.
> > 
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
> > Closes:
> > https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
> > Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
> > Closes:
> > https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
> > Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
> > Closes:
> > https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
> > Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
> > Closes:
> > https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
> > Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
> > Closes:
> > https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d
> 
> I still don't see Cc: stable@vger.kernel.org here.
> 
> > Assisted-by: Codex:gpt-5.6-sol
> > Reported-by: Kyle Zeng <kylebot@openai.com>
> > Signed-off-by: Kyle Zeng <kylebot@openai.com>
> > Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
> > ---
> >  fs/hfs/btree.c     | 7 +++++--
> >  fs/hfsplus/btree.c | 7 +++++--
> >  2 files changed, 10 insertions(+), 4 deletions(-)
> > 
> > diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
> > index 41b4e8fc9..4f0ddc76e 100644
> > --- a/fs/hfs/btree.c
> > +++ b/fs/hfs/btree.c
> > @@ -310,14 +310,17 @@ void hfs_btree_close(struct hfs_btree *tree)
> >  		return;
> >  
> >  	for (i = 0; i < NODE_HASH_SIZE; i++) {
> > +		spin_lock(&tree->hash_lock);
> >  		while ((node = tree->node_hash[i])) {
> > -			tree->node_hash[i] = node->next_hash;
> > +			hfs_bnode_unhash(node);
> > +			spin_unlock(&tree->hash_lock);
> >  			if (atomic_read(&node->refcnt))
> >  				pr_err("node %d:%d still has %d
> > user(s)!\n",
> >  				       node->tree->cnid, node-
> > >this,
> >  				       atomic_read(&node-
> > >refcnt));
> >  			hfs_bnode_free(node);
> > -			tree->node_hash_cnt--;
> > +			spin_lock(&tree->hash_lock);
> >  		}
> > +		spin_unlock(&tree->hash_lock);
> >  	}
> >  	iput(tree->inode);
> > diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
> > index 2ea8cd565..bd4dbdbc8 100644
> > --- a/fs/hfsplus/btree.c
> > +++ b/fs/hfsplus/btree.c
> > @@ -417,15 +417,18 @@ void hfs_btree_close(struct hfs_btree *tree)
> >  		return;
> >  
> >  	for (i = 0; i < NODE_HASH_SIZE; i++) {
> > +		spin_lock(&tree->hash_lock);
> >  		while ((node = tree->node_hash[i])) {
> > -			tree->node_hash[i] = node->next_hash;
> > +			hfs_bnode_unhash(node);
> > +			spin_unlock(&tree->hash_lock);
> >  			if (atomic_read(&node->refcnt))
> >  				pr_crit("node %d:%d "
> >  						"still has %d
> > user(s)!\n",
> >  					node->tree->cnid, node-
> > > this,
> >  					atomic_read(&node-
> > >refcnt));
> >  			hfs_bnode_free(node);
> > -			tree->node_hash_cnt--;
> > +			spin_lock(&tree->hash_lock);
> >  		}
> > +		spin_unlock(&tree->hash_lock);
> >  	}
> >  	iput(tree->inode);
> 
> I haven't any comments for the fix. But let me run xfstests for the
> patch (at minimum for HFS+).
> 
> 

I don't see any xfstests degradation for the case of HFS+. The patch
looks good.

Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>

Thanks,
Slava.